The present invention relates to systems and methods for secure trading mechanisms, and more particularly, to a system and a method for a secure trading mechanism combining wireless communication and wired communication, applied to a security mechanism for e-commerce (electronic commerce) over the internet so as to assure the security of end-to-end trading in the current use of the wireless communication.
Conventionally, a network is primarily used for transmitting e-mail and sharing peripheral computer resources. With the progress of electronic and communication technologies, the internet further provides a function of e-commerce, that is, access to processing a bank account, purchasing, claiming tax through the internet, etc. This makes human life more convenient and time-saving.
Currently, in order to claim tax through e-commerce, a user must apply an identity certificate from the government certification authority (GCA). At first, application software is downloaded from a web site of GCA, in which the user personally sets up a key to be stored in a xe2x80x9cprivate key diskxe2x80x9d and accordingly inputs related data to a xe2x80x9ccertificate diskxe2x80x9d for storage. Subsequently, the user having an identification card thereof and the xe2x80x9ccertificate diskxe2x80x9d can file for application at a service counter of the Taiwan Communication Company. After the application is successfully passed through examination, the user is able to download the identity certificate to the xe2x80x9ccertificate diskxe2x80x9d through the internet. Alternatively, if the user is a Hinet user, application for the identity certificate can be filed directly through the internet, while examination for the application is executed by a controlling system of Hinet. In this case, people can complete a process for claiming tax in a manner of acquiring an electronic pocket software and a trading certificate, and then uploading claim-related data to the government tax office through the internet. This therefore provides benefits such as convenience and time-saving for people, who had been always queued for claiming tax in the past.
However, the security for trading through the network is a potential problem. Since the internet and local networks are connected through communication protocols such as TCP, IP, UDP, FTP, RPC, PIC, HTTP, SMTP, IEEE802.3 (Ethernet), etc. Intrinsically, these communication protocols have no encryption mechanism. Therefore, the internet environment is opened, for example, a packet password can be easily captured from a local network. Obviously, in the condition of no encryption and no secure communication protocol available for data transmitted between different levels (or layers) of the networks, the transmitted data can not be securely protected.
Moreover, wireless mobile communication services have become a mainstream in current communication services. Further due to the difficulty in construction, a wired, dedicated or fiber communication system must be gradually replaced by a wireless communication system. Therefore, IEEE defines the IEEE 802.11 as a standard for a wireless local network; whereas security-related services include a secure socket layer (SSL) communication protocol from Netscape family, a secure electronic transaction (SET) protocol for a secure paying mechanism of e-commerce, etc., which are commonly used security mechanisms. For the wireless local network, a wireless modem is originally used, which only allows end-to-end connection and employs radio frequency as a wireless transmission medium, that is therefore easy to be illegally acquired, used and destroyed. In this case, security is a significant consideration in the use of such a wireless local network.
In conclusion, it is desired to develop a novel system for securely trading through network communications, in which security can be assured for two-way trading, and a transaction can be performed in real time.
A primary objective of the present invention is to provide a system and a method for a secure trading mechanism combining wireless communication and wired communication, which, in the condition of two-way trading constructed based on network connection of a wireless communication device functioning in two-way transmission to a trading server and a trading host of a wired communication devices, allow the trading to be performed in real time. Moreover, the system and method of the invention in the foregoing condition can determine the correctness for data transmitted between different levels of the network according to a secure communication protocol defined in each communication device, so as to assure the security of trading data in transmission. In addition, in the system and method of the invention under the foregoing condition, first, a personal identification number (PIN) input by a user and a device identification code of the wireless communication device are encrypted, respectively. Then, the encrypted PIN and device identification code are incorporated and digitally signed. Subsequently, the encrypted PIN, the encrypted device identification code and the digitally-signed data are incorporated and further encrypted. In the use of multiple and different encryption processes, the trading data can therefore be prevented from being acquired or changed without authorization.
According to the foregoing and other objectives, the present invention provides a system and a method for a secure trading mechanism combining wireless communication and wired communication. The system of the invention comprises: wired communication devices including a plurality of trading hosts, a plurality of trading servers, and a plurality of wireless and wired data exchange gateways; and wireless communication devices including a plurality of wireless communication message interchange centers and a wireless two-way communication device.
The trading hosts each has a memory unit for storing an identity identification code, a personal identification number, a device identification code dedicated for a wireless two-way communication device of a user and a plurality of sets of keys, which are input by the user to the trading host; a secure communication protocol for allowing data transmission and communication with the trading servers; encryption and decryption software for encrypting and decrypting data received and transmitted by the trading host; a method for determining correctness of the personal identification number during trading; a method for modifying the personal identification number; and a function of being a router, so as to allow the trading hosts to serve as devices for registration prior to performing trading.
The trading servers each has a memory unit for recording a look-up table of correlation between the trading server and the trading hosts; a secure communication protocol for data transmission and communication with the trading hosts, and with the wireless and wired data exchange gateways; and a function of being a router; and the trading servers serve as communication interfaces between the trading hosts and the wireless and wired data exchange gateways, in a manner that the trading servers receive data from the trading hosts and transmit the data to the wireless and wired data exchange gateways, or receive data from the wireless and wired data exchange gateways and transmit the data to the trading hosts.
The wireless and wired data exchange gateways each has a memory unit for recording a look-up table of correlation between a trading type and the trading servers; a secure communication protocol for data transmission and communication with the trading servers, and with the wireless communication message interchange centers; and a function of being a router; and the wireless and wired data exchange gateways receive data from the trading servers and transmit the data to the wireless communication message interchange centers, or receive data from the wireless communication message interchange centers and transmit the data to the trading servers, so as to allow the wireless and wired data exchange gateways to serve as communication interfaces between the trading servers and the wireless communication message interchange centers.
The wireless communication message interchange centers each has a communication device for receiving and transmitting wireless messages; a secure communication protocol for data transmission and communication with the wireless and wired data exchange gateways, and with the wireless two-way communication device; and a function of being a router; and the wireless communication message interchange centers receive data from the wireless and wired data exchange gateways and transmit to the wireless two-way communication device, or receive data from the wireless two-way communication device and transmit the data to the wireless and wired data exchange gateways, so as to allow the wireless communication message interchange centers to serve as communication interfaces between the wireless and wired data exchange gateways and the wireless two-way communication device.
The wireless two-way communication device has a communication device for receiving and transmitting wireless messages; a memory unit for storing trading data and a device identification code dedicated for the wireless two-way communication device; a smart card for storing a plurality of sets of keys; a secure communication protocol for data transmission and communication with the wireless communication message interchange centers; encryption and decryption software for encrypting and decrypting data received and transmitted by the wireless two-way communication device; a method for inputting the personal identification number; and software for managing the trading; and the wireless two-way communication device serves as a controlling center for trading management of the present system, and has a wireless communication number for identifying an address of a transmitting network.
The method for a secure trading mechanism combining wireless communication and wired communication of the invention comprises the following steps. First, a user registers at a trading host, wherein the user inputs data including an unique identity identification code, a personal identification number and a device identification code dedicated for a wireless two-way communication device of the user, and stores the data in a memory unit of the trading host. Then, trading is initiated between the trading host and the wireless two-way communication device, in a manner that the wireless two-way communication device acquires information of the user about to perform e-commerce, verifies the user in correct identity, and transmits a set of keys stored in the trading host to a smart card of the wireless two-way communication device for storage. Finally, the trading is performed between the wireless two-way communication device and the trading host, in a manner that after the user inputs related trading data to the wireless two-way communication device, the related trading data are encrypted by the set of keys and transmitted to the trading host, wherein the trading data is merely able to be decrypted by the trading host so as to assure security of the trading data in transmission.
Moreover, prior to initiating the trading and after completing the registration, the method of the invention further comprises the steps of: prior to transmitting uplink data in the trading initiation, inputting the user""s identity identification code, the personal identification number, a trading host code and a trading type code to the wireless two-way communication device; using the personal identification number as a key for being encrypted by an encryption method such as DES (data encryption standard), so as to acquire an encrypted personal identification number key to be stored in a memory unit of the wireless two-way communication device; encrypting the device identification code of the wireless two-way communication device by the personal identification number key so as to generate an encrypted device identification code; incorporating the personal identification number key and the encrypted device identification code, for being digitally signed by a one-way hash function so as to acquire a digital signature; incorporating the personal identification number key, the encrypted device identification code and the digital signature, for being symmetrically encrypted by the encrypted personal identification number key so as to acquire re-encrypted data; incorporating the trading host code, the trading type code, the identity identification code and the re-encrypted data, for being transmitted by the wireless two-way communication device to the trading host; prior to transmitting downlink data in the trading initiation, acquiring via the trading host a set of keys, i.e. a trading host key and a trading data key, relating to the identity identification code from the memory unit of the trading host according to the identity identification code; using the device identification code of the wireless two-way communication device and the personal identification number key as keys, for symmetrically encrypting the trading host key and the trading data key sequentially; incorporating the encrypted trading host and trading data keys to form a trading result, for being digitally signed by the one-way hash function so as to generate digitally signed data; and incorporating the identity identification code, the trading result and the digitally signed data, for being transmitted by the trading host to the wireless two-way communication device.
In addition, prior to performing the trading and after completing the trading initiation, the method of the invention further comprises the steps of: inputting the identity identification code, the personal identification number, a trading host code, a trading type code and related trading data to the wireless two-way communication device; using the personal identification number as a key, for being encrypted by a symmetric encryption method such as DES (data encryption standard), so as to acquire an encrypted personal identification number key; incorporating the encrypted personal identification number key and the trading data input to the wireless two-way communication device to form incorporated trading data for being digitally signed by a one-way hash function so as to acquire a digital signature, and incorporating the incorporated trading data and the digital signature to generate new incorporated trading data; symmetrically encrypting the new trading data by a trading data key of the set of keys in the trading initiation so as to acquire encrypted second incorporated trading data; incorporating the identity identification code and the encrypted second incorporated trading data to form third incorporated trading data, for being symmetrically encrypted by a trading host key of the set of keys in the trading initiation so as to generate re-encrypted third incorporated trading data; incorporating the trading host code, the device identification code of the wireless two-way communication device, the trading type code and the re-encrypted third incorporated trading data, for being transmitted by the wireless two-way communication device to the trading host; prior to transmitting downlink data in the trading performance, outputting via the trading host a trading result for being digitally signed by the one-way hash function so as to generate a digitally signed trading result, and incorporating the trading result and the digitally signed trading result to form trading data; obtaining via the trading host a trading data key in a set of keys relating to the identity identification code according to the identity identification code, and symmetrically encrypting the trading data by the trading data key so as to generate encrypted trading data; encrypting the encrypted trading data by the trading data key so as to form re-encrypted trading data; and incorporating the identity identification code and the re-encrypted trading data, for being transmitted by the trading host to the wireless two-way communication device.